CVE-2026-111344: APITable Authorization Bypass Vulnerability

CVE-2026-111344 Overview

CVE-2026-111344 is an authorization bypass vulnerability affecting APITable through version 1.14.0-beta. The flaw resides in the GET /node/{nodeId}/description endpoint within NodeController.java, which fails to enforce space membership and node permission checks. Authenticated users can supply an arbitrary nodeId belonging to another tenant and retrieve the associated node description. The issue enables cross-space disclosure of datasheet, folder, and form descriptions, breaking multi-tenant isolation. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Any authenticated APITable user can read node descriptions from any other space, exposing cross-tenant metadata about datasheets, folders, and forms without triggering access controls.

Affected Products

• APITable versions through 1.14.0-beta
• APITable backend-server component (NodeController.java)
• Self-hosted and multi-tenant APITable deployments

Discovery Timeline

• 2026-10-15 - CVE-2026-111344 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111344

Vulnerability Analysis

APITable is an open-source, API-first collaborative database platform organized around spaces, folders, datasheets, and forms. Each resource lives inside a space, and users are expected to access resources only within spaces they belong to.

The vulnerable handler is defined in NodeController.java at lines 1043-1057 of the v1.14.0-beta tag. The route GET /node/{nodeId}/description accepts a nodeId path parameter and returns the stored description for that node. The handler validates that the caller is authenticated but does not verify that the caller is a member of the space owning nodeId, nor does it evaluate node-level permissions.

Because nodeId values follow predictable prefixes (for example dst, fod, fom), an attacker can enumerate or guess identifiers across tenants. Each request returns the raw description content regardless of ownership, enabling systematic cross-tenant data harvesting.

Root Cause

The root cause is a missing authorization check tied to a user-controlled identifier, matching the pattern described in CWE-639. Other APITable endpoints route through permission services that verify space membership and node ACLs. The description endpoint omits this call path and queries the node repository directly using the supplied nodeId.

Attack Vector

An attacker needs only a valid, low-privileged APITable account on the target instance. The attacker issues an HTTP GET request to /node/{nodeId}/description using a nodeId from a different space, obtained through enumeration, prior reconnaissance, or external leaks. The server returns the description payload, disclosing potentially sensitive metadata such as schema notes, workflow instructions, or embedded credentials stored in descriptive fields. See the HackMD cross-site IDOR analysis and the VulnCheck advisory for the full request walkthrough.

// Vulnerability description only - no verified PoC code reproduced here.
// See the HackMD analysis and VulnCheck advisory for request-level details.

Detection Methods for CVE-2026-111344

Indicators of Compromise

• High-volume GET /node/{nodeId}/description requests from a single authenticated session targeting many distinct nodeId values.
• Access logs showing a user retrieving node descriptions for nodeId prefixes (dst, fod, fom) that do not belong to any of their member spaces.
• Unexpected 200 OK responses to description requests for nodes created by other tenants.

Detection Strategies

• Correlate the authenticated user's space membership with the owning space of each requested nodeId and flag mismatches.
• Baseline per-user request rates to /node/*/description and alert on sudden spikes consistent with enumeration.
• Hunt in web and application logs for sequential or dictionary-style nodeId patterns across short time windows.

Monitoring Recommendations

• Forward APITable backend-server access logs and audit events to a centralized analytics platform for cross-tenant correlation.
• Enable application-layer logging that captures the authenticated user ID alongside the nodeId and resolved owning space for every description request.
• Alert security operations on any user accessing node descriptions across more than one space within a defined period.

How to Mitigate CVE-2026-111344

Immediate Actions Required

• Restrict public exposure of APITable instances and require VPN or SSO-gated access until a patched release is deployed.
• Audit application logs for prior access to /node/{nodeId}/description and identify any users who queried nodes outside their space.
• Rotate secrets, API tokens, or credentials that may have been documented inside node descriptions on affected spaces.

Patch Information

At publication time, no fixed version was listed in NVD beyond the vulnerable 1.14.0-beta range. Monitor the APITable GitHub repository and the VulnCheck advisory for an official patch. Operators should upgrade to the first release that modifies NodeController.java to call the standard node permission service before returning description data.

Workarounds

• Deploy a reverse proxy or API gateway rule that blocks or restricts GET /node/*/description to known administrative accounts.
• Apply a local patch to NodeController.java that invokes the existing node permission check before returning the description payload.
• Minimize sensitive content stored in node description fields across datasheets, folders, and forms to reduce the blast radius of disclosure.

# Example NGINX rule to deny the vulnerable endpoint until patched
location ~ ^/node/[^/]+/description$ {
    deny all;
    return 403;
}